Authorize Tenant Webhook Subscriptions
Check who may create or change an outbound webhook subscription for a tenant.
A webhook subscription can send tenant events to an external destination. Adding or changing one is a data access decision, even if the user never downloads a file. A normal member may view events but lack permission to send them outside the organization. The OWASP Webhook Security Cheat Sheet covers outbound destination risks; tenant authorization adds the ownership rule.
Subscription permission matrix
| Action | Required decision |
|---|---|
| Create | Caller may configure outbound events for this tenant |
| Select events | Caller may expose these event types |
| Set destination | URL passes destination and SSRF policy |
| Change secret | Authorized admin controls signing material |
| Pause or delete | Caller may manage this subscription |
| Deliver | Worker uses the stored tenant owner and active state |
A destination URL is not a tenant identity. Store subscription ownership separately. The worker should not trust an event payload's tenant field without matching the stored subscription and source record. If event types contain different sensitivity levels, give them separate grants or approval rules.
Use a synthetic delivery
Create A and B test tenants with harmless marker events. Let an A administrator create a subscription to an owned test endpoint. Check that an A member without the grant cannot change the destination or event selection. Try to attach B's subscription ID to an A request; the server should deny before any new delivery. Pause the subscription and verify queued deliveries follow the documented stop rule. Inspect delivered payloads and logs for tenant markers and secret values.
OWASP Multi Tenant Security supports ownership across shared workers. This matrix is the artifact that joins subscription control and delivery. It does not authorize sending tests to a third-party URL. Keep destinations in an owned sandbox and agree on outbound scope before a customer review.
Test a subscription after the configuring admin leaves the tenant. The stored subscription may continue under an organization grant, but that must be an explicit policy. Confirm who can rotate its signing secret and who can pause delivery afterward.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.